It is possible to circumvent CSRF protection on TranskripRequest/add about bluetape HOT 4 CLOSED

Hi, just got this news from @levint55,

I have suggestion to uniform all the URL to mimics RESTful API, so instead doing POST /TranskripRequest/add, we just do POST /TranskripRequest, and make sure all endpoints do the same, as the URL will looks cleaner.

(maybe we can make it cuter with /transkrip-request? But as far as i know this will need some changes on the CI's config, so it's pain-in-the-neck)

What do you think?

On the implementations we just need to move the HTTP Method checking to the index(), make the add() private, and call it when the method is POST.

from bluetape.

Thanks @darknight060198 for the fix!

@chez14 Thank you for the suggestion. I will attend to your comment soon.

from bluetape.

Hi @chez14,

Thank you for your suggestion. I may be old school, but as of now I don't have any plans to convert this portal to a newer web standards, with the following considerations:

• I want to make it as simple as possible, allowing students to understand and participate in the code
• Rewriting the architecture means rewriting the group project task description for Keamanan Informasi
• UNPAR is not funding me for this 😆 and they already make me spend some time each month for printing out the receipt from cloud provider, to reimburse the provider cost (they pay for the cloud provider but not me). Hence, I don't want to invest too much time on this.

There is an alternative though, if admin team wants to takeover this whole project, I will be willing to handover it to them. I cannot transfer it to you personally, because although you have the technical capabilities, but this project must be continued even after you graduated.

I am closing this issue. Please reopen if you want to appeal. Thank you.

from bluetape.

Ahh i see, i don't think admin will have time for managing OSS project right now, since we have things to do with our backend too, so i'll leave it like this then hehe.

from bluetape.